Author Topic: Unsecure bb code video blocks  (Read 5772 times)

0 Members and 1 Guest are viewing this topic.

Offline Jim Bauwens

  • Lua! Nspire! Linux!
  • Editor
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1881
  • Rating: +206/-7
  • Linux!
    • View Profile
    • nothing...
Unsecure bb code video blocks
« on: July 29, 2013, 06:45:06 am »
As I demostrated here, http://ourl.ca/19304, you can easily manipulate the URL that gets loaded inside the vimeo player (just an iframe). Although you're still limited to the player.vimeo.com domain (you can load any site on that domain) I think here should be some added protections. The same issue with Nico video player, you can load any JS script from the ext.nicovideo.jp domain. While this still is very restricted, it's important to remember that if Vimeo or Nico change something on their website, those stuff might be used to exploit stuff here.

Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Unsecure bb code video blocks
« Reply #1 on: July 29, 2013, 07:11:20 am »
Are those tags at all used? Because IMO they could be removed if not.....

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55941
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Unsecure bb code video blocks
« Reply #2 on: July 29, 2013, 01:24:06 pm »
Wow I totally forgot that those tags existed. I believe I added them via custom BBCode, as well as the wikipedia ones. Since they are hardly ever used I guess they could be removed. However, it might be worth it to check if the Wikipedia/etc tags have the same problem as well, because if that's the case, then it's the entire custom BBCode mod that is at fault and it should be reported to its author on SMF.

Offline Scipi

  • Omni Kitten Meow~ =^ω^=
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1547
  • Rating: +192/-3
  • Meow :3
    • View Profile
    • ScipiSoftware
Re: Unsecure bb code video blocks
« Reply #3 on: July 29, 2013, 04:59:54 pm »
* Scipi just thought of an evil, EVIL idea, that he'll never do.

Imagine if someone realized that, and trolled the entire forum by putting that in their signature. (Under a spoiler, to make it difficult to see where the Rick Roll is coming from.

Imma Cat! =^_^= :3 (It's an emoticon now!)
Spoiler For Things I find interesting:
Spoiler For AI Programming:
Spoiler For Shameless advertising:

Spoiler For OldSig:





Spoiler For IMPORTANT NEWS!:
Late last night, Quebec was invaded by a group calling themselves, "Omnimaga". Not much is known about these mysterious people except that they all carried calculators of some kind and they all seemed to converge on one house in particular. Experts estimate that the combined power of their fabled calculators is greater than all the worlds super computers put together. The group seems to be holding out in the home of a certain DJ_O, who the Omnimagians claim to be their founder. Such power has put the world at a standstill with everyone waiting to see what the Omnimagians will do...

Wait... This just in, the Omnimagians have sent the UN a list of demands that must be met or else the world will be "submitted to the wrath of Netham45's Lobster Army". Such demands include >9001 crates of peanuts, sacrificial blue lobsters, and a wide assortment of cherry flavored items. With such computing power stored in the hands of such people, we can only hope these demands are met.

In the wake of these events, we can only ask, Why? Why do these people make these demands, what caused them to gather, and what are their future plans...

Offline TIfanx1999

  • ಠ_ಠ ( ͡° ͜ʖ ͡°)
  • CoT Emeritus
  • LV13 Extreme Addict (Next: 9001)
  • *
  • Posts: 6173
  • Rating: +191/-9
    • View Profile
Re: Unsecure bb code video blocks
« Reply #4 on: July 29, 2013, 05:02:21 pm »
*cough* We already thought of that. :P But yea. NO ONE DO THAT.

Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Unsecure bb code video blocks
« Reply #5 on: July 29, 2013, 05:45:29 pm »
so THAT is why spoilers aren't allowed anymore in sigs XD
Also, I laready thought of that

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline Darl181

  • «Yo buddy, you still alive?»
  • CoT Emeritus
  • LV12 Extreme Poster (Next: 5000)
  • *
  • Posts: 3408
  • Rating: +305/-13
  • VGhlIEdhbWU=
    • View Profile
    • darl181.webuda.com
Re: Unsecure bb code video blocks
« Reply #6 on: July 29, 2013, 06:15:46 pm »
Believe it or not, it's already been done, except invisible :P (a certain retired admin who had a knack for embedding stuff)

Anyway, hope there's a fix for this :/ at least it can't just load code from anywhere.

« Last Edit: July 29, 2013, 06:16:24 pm by Darl181 »
Vy'o'us pleorsdti thl'e gjaemue

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55941
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Re: Re: Unsecure bb code video blocks
« Reply #7 on: July 29, 2013, 07:29:32 pm »
Believe it or not, it's already been done, except invisible :P (a certain retired admin who had a knack for embedding stuff)

Anyway, hope there's a fix for this :/ at least it can't just load code from anywhere.
Two admins actually :P

Also it used HTML bbcode, not an exploit (admins can put HTML inside posts)

Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Unsecure bb code video blocks
« Reply #8 on: July 29, 2013, 07:30:24 pm »
Can they still do that? O.O i thought it was disabled by now

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55941
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Unsecure bb code video blocks
« Reply #9 on: July 29, 2013, 07:56:21 pm »
I doubt it was disabled, since no admin ever abused it dangerously. The farthest it ever went was the embedded rickrolls by me and ztrumpet, that one redirect by me (fake intro topic) and other than that it has actually been pretty useful. For example, in the tutorials section, older tutorials were made so that if the author edits his forum topic, it automatically updates the tutorial too, or other things such as that one tutorial Eeems made once with pretty colors.

Plus, even if HTML ever got disabled, admins could just add it via the database anyway :P
« Last Edit: July 29, 2013, 07:57:05 pm by DJ Omnimaga »

Offline Juju

  • Incredibly sexy mare
  • Coder Of Tomorrow
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 5730
  • Rating: +500/-19
  • Weird programmer
    • View Profile
    • juju2143's shed
Re: Unsecure bb code video blocks
« Reply #10 on: July 29, 2013, 08:39:07 pm »
Yeah, I think I was the one who added the vimeo and Niconico tags, you had to do something like http://player.vimeo.com/video/<videoid> where <videoid> is whatever inside the tag. I doubt there will be any security issue by adding the extra options (as Vimeo or whatever will make sure there isn't any security issue in their own player), and you won't be able to hide the player by setting the width/height to 0. Plus I bet it would be kinda a PITA to write something that removes those options.

So I would say to leave this as it is now as nothing harmful would happen other than scaring someone with an autoplay (thing at least 2-3 (former) admins already did).

Remember the day the walrus started to fly...

I finally cleared my sig after 4 years you're happy now?
THEGAME
This signature is ridiculously large you've been warned.

The cute mare that used to be in my avatar is Yuki Kagayaki, you can follow her on Facebook and Tumblr.

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55941
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Unsecure bb code video blocks
« Reply #11 on: July 29, 2013, 08:40:32 pm »
Actually I might have added them. I know I added the [Netham45] bbcode, along with Wikipedia, TI-BD and stuff, but I'm unsure anymore about the rest. I might have enabled one video site, though.

EDIT Here's the article: http://ourl.ca/11543 (a month before I quit my admin position entirely). I added Nico, but you added Vimeo it seems.
« Last Edit: July 29, 2013, 08:42:02 pm by DJ Omnimaga »

Offline Deep Toaster

  • So much to do, so much time, so little motivation
  • Administrator
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 8217
  • Rating: +758/-15
    • View Profile
    • ClrHome
Re: Unsecure bb code video blocks
« Reply #12 on: August 06, 2013, 12:59:58 am »
Can they still do that? O.O i thought it was disabled by now
Admins can. I don't think there's a problem with that, seeing as how the same people could just delete most of Omnimaga if they wanted >.>

I think if a lot of these BBCodes aren't getting used, we don't really have a reason to keep them around. They can make post submission slower and clutter the post editor with extra buttons.




Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Unsecure bb code video blocks
« Reply #13 on: August 06, 2013, 05:11:01 am »
[...] and clutter the post editor with extra buttons.
There is already a bunch of bb-code tags which don't appear as buttons in the editor....

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline Eiyeron

  • Urist McEiyolobster
  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1430
  • Rating: +130/-10
  • (-_(//));
    • View Profile
    • Rétro-Actif : Rétro/Prog/Blog
Re: Unsecure bb code video blocks
« Reply #14 on: August 06, 2013, 10:21:06 am »
[...] and clutter the post editor with extra buttons.
There is already a bunch of bb-code tags which don't appear as buttons in the editor....

Which? [theGame]YOu lost it?[/theGame]